[Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces

[Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces

[The Q]

[-- Attachment #1: Type: text/plain, Size: 249 bytes --]

 

Hi all

 

Assume that you have a linux bridge with two interfaces eth0 and eth1
enslaved to this bridge

What is the difference between sniffing the bridge and sniffing its
interfaces?

 

tcpdump -i br0   vs tcpdump -i eth0

 

Thanks

MiniME


[-- Attachment #2: Type: text/html, Size: 2229 bytes --]

Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces

[Joel Wirāmu Pauling]

[-- Attachment #1: Type: text/plain, Size: 1253 bytes --]

I can think of several potential differences. ​You may miss any bridge
specific traffic (STP, LLDP) using the interfaces generated by the bridge
itself.

If you have vlan tagged sub interfaces you might also miss that traffic if
you were snooping a particular interface. Obviously you will miss any
on-wire broadcast traffic specific to the layer1 connection a particular
interface was connected to if you sniff on an individual device.

Basically unless you are trying to trouble shoot a physical link issue I
would likely always use the container link when doing a packet dump, due to
several edge cases.

If your bridge node host is participating (i.e has an IP etc on the br0
device itself , rather than in the case of a container for Vtap's/Virtual
machine nics') You would also miss the hypervisors/hosts traffic if you
sniffed the contained nics.


-Joel



On 16 February 2015 at 15:35, The Q <theq@rogers.com> wrote:

>
>
> Hi all
>
>
>
> Assume that you have a linux bridge with two interfaces eth0 and eth1
> enslaved to this bridge
>
> What is the difference between sniffing the bridge and sniffing its
> interfaces?
>
>
>
> tcpdump -i br0   vs tcpdump –i eth0
>
>
>
> Thanks
>
> MiniME
>

[-- Attachment #2: Type: text/html, Size: 2801 bytes --]

Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces

[Stephen Hemminger]

[-- Attachment #1: Type: text/plain, Size: 174 bytes --]

Sniffing on bridge only shows traffic destined for the Mac address of the
bridge device.

Whereas sniffing on a physical device will show all traffic going over that
device.

[-- Attachment #2: Type: text/html, Size: 212 bytes --]

Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces

[Q]

[-- Attachment #1: Type: text/plain, Size: 2123 bytes --]

Thanks Joel

I have the feeling that you are using developer terms which I don’t totally udersta

I will rephrase what I believe you said below, just to make sure that I got the idea:

 

Eth0ßà br0ßàeth1

 

From what you are saying if I sniff eth0 only there is chances that I will miss L1 traffic injected by the host or by the other eth1

If eth0 and eht1 have respectively vlan 1 and vlan 2 the only way to sniff both simultaneously would be by sniffing br0

There are also L1-L2 packet originated by br0 that might be misses

 

Are these correct?

 

Thanks

Q

 

From: aenertia@aenertia.net [mailto:aenertia@aenertia.net] On Behalf Of Joel Wiramu Pauling
Sent: February-16-15 5:17 PM
To: The Q
Cc: bridge@lists.linux-foundation.org
Subject: Re: [Bridge] Sniffing a linux bridge vs sniffing enslaved interfaces

 

I can think of several potential differences. ​You may miss any bridge specific traffic (STP, LLDP) using the interfaces generated by the bridge itself.

 

If you have vlan tagged sub interfaces you might also miss that traffic if you were snooping a particular interface. Obviously you will miss any on-wire broadcast traffic specific to the layer1 connection a particular interface was connected to if you sniff on an individual device. 

 

Basically unless you are trying to trouble shoot a physical link issue I would likely always use the container link when doing a packet dump, due to several edge cases. 

 

If your bridge node host is participating (i.e has an IP etc on the br0 device itself , rather than in the case of a container for Vtap's/Virtual machine nics') You would also miss the hypervisors/hosts traffic if you sniffed the contained nics.

 

 

-Joel

 

 

 

On 16 February 2015 at 15:35, The Q <theq@rogers.com> wrote:

 

Hi all

 

Assume that you have a linux bridge with two interfaces eth0 and eth1 enslaved to this bridge

What is the difference between sniffing the bridge and sniffing its interfaces?

 

tcpdump -i br0   vs tcpdump –i eth0

 

Thanks

MiniME

 


[-- Attachment #2: Type: text/html, Size: 8922 bytes --]